CORS allowlist from configuration (task 61) #20

Merged

rob merged 1 commit from feat/cors-policy into main

2026-08-03 14:13:18 +00:00

rob commented

2026-08-03 12:51:46 +00:00

Owner

Origins come from Cors:AllowedOrigins; a malformed one is fatal at start-up. AllowCredentials is not set. traceparent/tracestate are allowed, closing half of ADR-0015's correlation carve-out. Recorded in ADR-0024.

docs/adr/README.md will conflict with PR #21 — keep 0024 above 0025.

Origins come from `Cors:AllowedOrigins`; a malformed one is fatal at start-up. `AllowCredentials` is not set. `traceparent`/`tracestate` are allowed, closing half of ADR-0015's correlation carve-out. Recorded in ADR-0024. `docs/adr/README.md` will conflict with PR #21 — keep 0024 above 0025.

rob added 1 commit

2026-08-03 12:51:46 +00:00

Add a CORS allowlist from configuration

CI / build (pull_request) Successful in 44s

Details

7469db5494

Origins come from Cors:AllowedOrigins with no wildcard and no
IsDevelopment branch in code. appsettings.json declares the key empty —
the deployed origin is not known to the repository, and an empty list
allows no browser while leaving every non-browser caller untouched.
Development lists the two origins the WebUI launch profiles serve from,
as configuration rather than a code fallback, pinned by a test that
configures nothing.

A malformed origin is fatal at start-up, naming the value. A trailing
slash matches nothing, and the failure is otherwise invisible
server-side: the API starts, health-checks, and serves everyone except
the WebUI.

traceparent and tracestate are allowed, which closes the API half of
ADR-0015's correlation carve-out. Propagation is demonstrated rather than
asserted: the test sends the preflight, applies the browser's own rule by
adding the header only if the preflight permitted it, and asserts the API
logged under the caller's trace id. Removing traceparent from the
allowlist fails it on the correlation.

AllowCredentials is not set. It governs credentials the browser attaches
itself, and the bearer token is put in a header by client code. Enabling
it would grant nothing and turn any future allowlist mistake into a
session hijack.

UseCors sits inside UseHttpLogging and before UseHttpsRedirection, both
verified by moving the line and watching a test break: outside the former
a refused preflight is invisible server-side, and after the latter a
preflight is redirected rather than answered. Placement inside
UseExceptionHandler is convention — measured that the permission is
applied as the response starts, so clearing the response cannot take it.

~~rob referenced this pull request 2026-08-03 12:52:02 +00:00~~

Validate requests with data annotations (task 59) #21

rob commented

2026-08-03 13:00:34 +00:00

Author

Owner

Nothing blocking. Four things for ADR-0024's consequences, none needing a code change now:

Vary: Origin is emitted only when more than one origin is configured, so the single-origin production case ships Access-Control-Allow-Origin without it.
Access-Control-Expose-Headers is unset — this will bite on the first 201 with a Location.
tracestate is the only allowed header no test pins.
RequireOrigin rejects uppercase scheme/host and an explicit :443, but its message mentions only trailing slashes and paths.

Verdict: mergeable

Nothing blocking. Four things for ADR-0024's consequences, none needing a code change now: - `Vary: Origin` is emitted only when more than one origin is configured, so the single-origin production case ships `Access-Control-Allow-Origin` without it. - `Access-Control-Expose-Headers` is unset — this will bite on the first 201 with a `Location`. - `tracestate` is the only allowed header no test pins. - `RequireOrigin` rejects uppercase scheme/host and an explicit `:443`, but its message mentions only trailing slashes and paths. Verdict: mergeable

rob referenced this pull request

2026-08-03 14:08:14 +00:00

Blazor layout shell and theming foundation (task 86) #23

rob merged commit 9a6b885788 into main

2026-08-03 14:13:18 +00:00

rob referenced this pull request from a commit

2026-08-03 14:13:18 +00:00

CORS allowlist from configuration (#20)